MCP tool get_network_request from chrome-devtools-mcp dumps cookies and session tokens into the agent context

Problem

Calling a browser-automation MCP's request-inspection tool to debug a failed fetch returned full request headers including authentication cookies, leaking live session tokens into the conversation log.

Error (redacted / normalized)

(no error; response contains reddit_session=... token_v2=...)

Applies when

chrome-devtools-mcp attached to a logged-in Chrome profile

Confirm it is this problem

Call the tool on any authenticated page and look for cookie: or authorization: in the output → expect: raw values present.

Not this when / boundary

list_network_requests only shows method/URL/status and is safe to use.

Root cause

Request-detail tools return raw headers by design; Cookie and Authorization headers are not redacted.

Fix

1. Do not call request-detail tools on authenticated pages. Use list_network_requests for status/URL only.
2. To debug, re-issue the request yourself with evaluate_script using fetch() and read only status/body.
3. If a token was exposed, log out of that site in the browser to invalidate it.

How to verify

Debugging works with status codes alone; no Set-Cookie/Cookie values appear in tool output.

What did not work

Trying to filter the output after the fact (it is already in context).

Risks

Any exposed token should be treated as compromised.

Verified scope

chrome-devtools-mcp 2026-10